Critical severity9.8NVD Advisory· Published Jul 31, 2025· Updated Apr 15, 2026

CVE-2025-50475

Description

An OS command injection vulnerability exists in Russound MBX-PRE-D67F firmware version 3.1.6, allowing unauthenticated attackers to execute arbitrary commands as root via crafted input to the hostname parameter in network configuration requests. This vulnerability stems from improper neutralization of special elements used in an OS command within the network configuration handler, enabling remote code execution with the highest privileges.

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

drive.google.com/file/d/1ZmZHzJKU-nrhFXd9w94aiGXYYYldtmni/viewnvd
pastebin.com/ic8hkC5Vnvd
pastebin.com/raw/0U6F55G5nvd

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000